Loading story…
Ransomware operators, including groups such as Akira and Qilin, are increasingly targeting midsize businesses as large enterprises bolster their defenses and reduce ransom payouts. Midsize organizations, which often have complex IT environments but limited security staff and resources, are seen as lucrative targets due to their ability to pay meaningful ransoms while lacking the advanced detection and response capabilities of larger enterprises. This shift in threat actor tactics has heightened the need for adaptable, well-trained cybersecurity professionals who can implement enterprise-grade protections tailored to the unique constraints of smaller organizations.
The evolving threat landscape has created a surge in demand for cybersecurity experts capable of designing and scaling effective security strategies for midsize firms with finite budgets. These professionals must balance technical controls with business operations, often taking on multiple roles due to limited staffing. As ransomware groups continue to exploit these vulnerabilities, the cybersecurity career landscape is expanding, emphasizing the importance of skilled defenders who can address the specific challenges faced by the mid-market sector.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware activity accelerated sharply from late 2025 into early 2026, with Black Kite tracking **7,551 known victims worldwide** during a 12-month study period and attributing the rise to a fragmented criminal ecosystem rather than AI alone. More than **60 new ransomware groups** entered the market, established operators including **Qilin, Everest, Cl0p, and World Leaks** remained active, and attackers increasingly shifted toward smaller, less-defended organizations. Manufacturing was the most targeted sector, US organizations accounted for nearly half of observed victims, and Europe recorded a faster growth rate than the US. The surge is intensifying pressure on victims to decide whether to pay, with reporting citing 2025 Sophos research that **nearly half of targeted companies** ultimately paid ransom demands and that median demands are rising globally. Security practitioners and policy debates are now focusing on whether public-sector payment bans would curb attacker profits or instead raise cyber-insurance costs and expand demand for negotiators, incident responders, and breach coaches. Across the reporting, defenders emphasized that the most effective response is stronger exposure management, continuous monitoring, **MFA**, least-privilege access, resilient backups, and better visibility into third-party and SaaS risk before compromise occurs.
Jul 24, 2026
Ransomware attacks continue to pose a significant threat to organizations, with recent surveys indicating that paying the ransom does not guarantee successful data recovery. According to Hiscox’s Cyber Readiness Report, only 60% of companies that paid a ransom were able to recover all or part of their data, while 40% lost their data despite payment. The technical sophistication of ransomware operators varies, with established groups more likely to provide functional decryptors, but many victims still face flawed encryption or unresponsive attackers. Additionally, the frequency of ransomware incidents has surged, with reports showing a near tripling of cases year-over-year in early 2025, and a majority of victims experiencing data theft even after paying ransoms. The ransomware landscape has evolved from high-volume, opportunistic attacks to a "big game hunting" model, where adversaries selectively target organizations with the most to lose and the greatest ability to pay. New criminal syndicates such as Spoiled Scorpius (RansomHub) and Howling Scorpius (Akira) are conducting sophisticated, long-term campaigns against high-value targets, often employing multi-extortion tactics that combine data encryption with threats of public exposure. This strategic shift has transformed ransomware from a purely IT issue into a critical business continuity threat, requiring organizations to adopt new defensive strategies and prepare for more calculated, high-impact attacks.
Jun 29, 2026
Ransomware operators are increasingly leveraging supply chain attacks and credential harvesting to expand their reach and maximize profits. Notable groups such as Qilin, Akira, Sinobi, INC Ransom, and Play have been identified as leading actors, with the Clop group repeatedly exploiting zero-day vulnerabilities in widely used software, including managed file transfer solutions and Oracle E-Business Suite, to compromise multiple organizations simultaneously. The volume of ransomware victims listed on data leak sites surged by one-third from September to October, according to Cyble, highlighting the persistent threat posed by these actors. Despite a decrease in total ransom payments from $1.25 billion in 2023 to $814 million in 2024, ransomware groups are actively innovating to reverse this trend, including launching new affiliate programs and refining their attack techniques. However, some operations have suffered from sloppy coding, occasionally resulting in unrecoverable data. The continued evolution of ransomware tactics underscores the need for organizations to strengthen defenses against both direct and supply chain threats, as well as to monitor for credential harvesting activities that may precede future attacks.
Jun 29, 2026